I have just one physical NIC (eth0) and some libvirt networks. Each network created represents one customer and it is working fine. My question is how can I protect between the customer's networks?

For example: The host 192.168.2.2 from the network 192.168.2.0/30 can not access any VM in others networks but the 192.168.2.2 can access 192.168.0.1 because it is the gateway to the internet and this host can receive incoming connections from the internet.

I would like to tag with VLAN for example but I don't have sure if this is the best way. 

See below my route table

Thank you guys.

Thiago